Audit logs

An append-only record of actions in your tenant: users created, tokens minted, messages sent, members added, API keys created, and more. Use it for compliance reports and for working out what an integration did.

Entries are written in the background, so a new one can take a moment to appear.

GET/v1/audit_logs

API keyaudit:read

Query parameters

Name	Type	Default	Description
`limit`	integer	50	1–200. Values outside the range are clamped.
`cursor`	string	none	The previous page's `next_cursor`.

There are no filters. To find particular entries, page through and filter on your side.

Response

200, newest first:

{
  "data": [
    {
      "id": "0c6f1a3e-8b2d-4e7f-9a5c-1d3b5e7f9a02",
      "tenant_id": "65787825-3152-4c1e-9b8a-0d6f4e2a7c11",
      "actor_type": "user",
      "actor_id": "11111111-2222-3333-4444-555555555555",
      "action": "messaging.message.sent",
      "target_type": null,
      "target_id": null,
      "metadata": {
        "conversation_id": "c8a1f4e2-6b3d-4f7a-9c2e-1d5b8a0f3e61",
        "message_id": "5f0c2a7e-8d1b-4e3f-a6c9-2b7d0e4f1a38",
        "sender_id": "11111111-2222-3333-4444-555555555555",
        "type": "text",
        "sequence": 184,
        "measurements": { "count": 1, "body_bytes": 41 }
      },
      "ip": null,
      "request_id": null,
      "created_at": "2026-06-02T08:13:55.123456Z"
    }
  ],
  "next_cursor": "0c6f1a3e-8b2d-4e7f-9a5c-1d3b5e7f9a02"
}

Field	Type	Description
`id`	uuid
`actor_type`	string	Who acted: `user` (an end-user), `api_key`, `system` (poolse itself), `customer_user` (someone on your dashboard), or `admin` (poolse operations staff).
`actor_id`	string \| null	The user's, API key's, or dashboard user's id.
`action`	string	What happened. See below.
`target_type`, `target_id`	string \| null	Set on dashboard entries (`target_type: "tenant"`). Usually `null` otherwise.
`metadata`	object	Details of the action. Its keys depend on the action. `measurements` holds counts.
`ip`, `request_id`	string \| null	Usually `null`.
`created_at`	string	ISO 8601.

next_cursor is set when the page is full and null otherwise. A full last page therefore gives a cursor whose next page is empty. Pass the cursor back unchanged.

curl "https://api.poolse.dev/v1/audit_logs?limit=200" \
  -H "Authorization: Bearer $POOLSE_API_KEY"

Actions

Action	When
`tenants.created`, `tenants.updated`, `tenants.deleted`	The tenant was created, changed or deleted.
`tenants.api_key.created`, `tenants.api_key.revoked`	An API key was created or revoked.
`dashboard.api_key.created`, `dashboard.api_key.revoked`	The same, recorded with the dashboard user who did it (`actor_type: "customer_user"`).
`identity.user.upserted`	A user was created or updated with `POST /v1/users`.
`identity.user.lazy_provisioned`	A user was created implicitly from `member_external_ids` / `external_ids`.
`identity.user_token.minted`	A user token was minted.
`identity.user_token.revoked`	A user token was revoked.
`conversations.created`, `conversations.updated`, `conversations.deleted`	A conversation was created, changed or deleted.
`conversations.member.added`, `conversations.member.removed`	A member joined or left.
`conversations.member.role_changed`	A member's role changed.
`messaging.message.sent`, `messaging.message.edited`, `messaging.message.deleted`	A message was sent, edited or deleted.
`messaging.reaction.added`, `messaging.reaction.removed`	A reaction was added or removed.
`messaging.read.marked`	A user's read position moved.
`rate_limit.token_mint.denied`	A token mint was refused by the 60-per-minute limit.
`idempotency.replayed`	A request with a reused `Idempotency-Key` got the stored response.
`admin.tenant_suspend`, `admin.tenant_unsuspend`	poolse operations suspended or restored the tenant.
`admin.tenant_plan_grant`, `admin.tenant_plan_revoke`	poolse operations granted or removed a plan.

Errors

Code	Status	When
`forbidden`	403	The API key lacks `audit:read`.
`bad_request`	400	`cursor` is not a valid UUID.

A cursor that is a valid UUID but not an existing entry returns an empty data list.